Prepare for the December 2026 ADM deadline.
Aicura supports the work of cataloguing your AI systems and drafting a privacy policy that addresses APP 1.7 to 1.9.
What's required
The Privacy and Other Legislation Amendment Act 2024 added new transparency obligations to APP 1 of the Privacy Act, all of which commence on 10 December 2026. APP 1.7 requires APP entities that make significant decisions about individuals using AI or other automated processes to disclose that fact in their privacy policy. APP 1.8 requires disclosure of the kinds of personal information used in those decisions. APP 1.9 requires disclosure of the kinds of decisions being made.
From the commencement date every APP entity needs an updated privacy policy that addresses these obligations, and the OAIC is preparing for compliance review activity from the same day. The longer reading of what each obligation requires sits on the ADM framework page.
Catalogue your AI systems
The first time you sign in, the register is empty and the deadline counter is already counting down. You start by adding the systems your organisation actually uses, and Aicura ships with a prefill catalogue of well-known products, so vendor entries usually mean selecting from the catalogue rather than typing into a blank form. For systems built in-house, the Helper PDF lets you collect the technical fields offline from your data science team without making them learn the app, and what comes back gets uploaded straight into the register.
Get guidance on your privacy policy
Once the register has substance, you upload your existing privacy policy as a PDF. Aicura extracts the text, asks you to confirm the extraction is clean, then reviews the document and returns guidance shaped by the ADM transparency requirements in APP 1.7 to 1.9 and the AI systems in your register. The guidance is specific rather than generic, since it draws on the systems you actually operate. Aicura keeps the full history of guidance against each document. When the register changes or the underlying rules shift, a notification surfaces suggesting which documents may want fresh guidance. You decide what to run, and the previous round stays beside the new one.
Draft an ADM transparency statement
In the same workflow Aicura also drafts a transparency statement, assembled from your register data. The wording reflects what your systems do, including which ones affect individuals, which decisions are automated and which involve human review, and what kinds of personal information are used. You can edit the wording directly, regenerate after you have made register changes, and run it through Aicura's human-in-the-loop approval before your team treats it as ready to share with reviewers.
Cycle through legal review without rework
Most organisations send the draft to internal counsel and then on to external counsel. External counsel typically comes back with comments on phrasing and scope, particularly around what counts as "automated" given any human checkpoints in your decision processes. When you make register changes to reflect their feedback, you regenerate the draft and the new version reflects the corrections cleanly. You are not rewriting the same statement from scratch each time.
Publish, then maintain
Your web team publishes the updated privacy policy when your organisation is satisfied with it. After that the work becomes ongoing. When you add or update an AI system in the register, a notification surfaces against any documents that may want re-checking. When the underlying ADM rules shift, the same kind of notification appears against your active policy documents. You decide what to run and the trail stays current.
After publication, the work is no longer about a deadline. The register, your privacy policy, and the history of guidance Aicura produced along the way live in the same place and stay connected as the work continues. When questions come from the OAIC, your audit committee, or your board, your team has somewhere concrete to draw on.
Frequently asked questions
Do I have to disclose AI in my privacy policy?
Yes, where your organisation uses a computer program to make, or substantially help make, a decision that significantly affects a person. From 10 December 2026 Australian Privacy Principle 1.7 to 1.9 require you to set this out inside the privacy policy itself, naming the kinds of decisions made and the kinds of personal information used. The date is the trigger and not the finish, so you keep the disclosure true as you add and change automated-decision systems.
What counts as an automated decision?
An automated decision is one a computer program makes wholly or substantially by automated means, where the outcome significantly affects a person's rights or interests. This covers both fully-automated decisions, where no person reviews the result, and substantially-assisted ones, where a system does the deciding work and a person signs off. A person clicking approve at the end does not move a decision out of scope if the system shaped the outcome.
Does a human reviewing the decision take it out of scope?
Not on its own. The test in APP 1.7 is whether the decision is made wholly or substantially by automated means, so a decision where a system does the substantive work and a person approves the result is still in scope. The line that matters is whether the person adds independent judgment or rubber-stamps the system's output.
What do I need in place by 10 December 2026, and after?
By 10 December 2026 your privacy policy needs a disclosure for each automated decision that significantly affects a person, set out in the policy APP 1 governs. After the date that disclosure has to stay accurate, because a statement that was true in December goes wrong the moment a new system ships or an old one is retired. The work is ongoing, so you keep the policy reconciled to the systems your organisation actually runs.
Keep the disclosure true after December
The 10 December 2026 deadline is the reason to start now, and keeping the disclosure true afterwards is the reason to stay. Every time your organisation adds or changes an automated-decision system, the privacy policy has to keep up, or the disclosure stops matching what you actually run. Aicura keeps the AI Register and the privacy policy reconciled as that happens, so the disclosure stays current long after the deadline passes. If you would rather see the work first, the guided tour walks through the register, the policy review and what it surfaces without asking for an account.